[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

zations. The risk management activities at Tier 2 begin with the identification and establishment of riskaware mission/business processes to support the organizational missions and business functions.
A risk-aware mission/business process is one that explicitly takes into account the likely risk such a process would cause if implemented. Risk aware processes are designed to manage risk in accordance with the risk management strategy defined at Tier 1 and explicitly account for risk when evaluating the mission/business activities and decisions at Tier 2. 34 Implementing riskaware mission/business processes requires a thorough understanding of the organizational missions and business functions and the relationships among missions/business functions and supporting processes. This understanding is a prerequisite to building mission/business processes sufficiently resilient to withstand a wide variety of threats including routine and sophisticated cyber attacks, errors/accidents, and natural disasters. An important part of achieving risk-aware processes is the understanding of senior leaders/executives of: (i) the types of threat sources and threat events that can adversely affect the ability of organizations to successfully execute their missions/business functions); (ii) the potential adverse impacts/consequences on organizational operations and assets, individuals, other organizations, or the Nation if the confidentiality, integrity, or availability of information or information systems used in a mission/business process is compromised; and (iii) the likely resilience to such a compromise that can be achieved with a given mission/business process definition, applying realistic expectations for the resilience of information technology.

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case:

- Machining Stations 1, 2, 3 - All manufacturing functions are performed by sequential CNC machining stations (1, 2, and 3). Each station uses preprogrammed operations (e.g., G code) to complete its required manufacturing process tasks. This code, and all station functions, have direct control over the output product quality. - Inspection Station 4 - If product quality has been impacted (i.e., the product dimensions do not meet the defined specifications), the inspection station will reject the part. Misconfiguration or modification of specifications loaded into the inspection station could allow out-of-spec parts to erroneously pass inspection. - Robots - Tending of parts between the machines is handled by the two workcell robots. This process requires accurate and repeatable placement of parts within the machining station fixtures, which is performed through proper robot calibration and the programming of waypoint coordinates. Parts that are not properly placed within fixtures, or collide with the fixtures, may not meet product quality specifications. - Supervisory PLC - The supervisory PLC tracks each part as it goes through the manufacturing process and commands the robots to transport each part between machines in a sequential manner. If a robot executes a job out-of-order, a part may bypass one of the machining stations, impacting product quality, or damaging one of the downstream stations. - Human Machine Interface (HMI) - Operators can manipulate workcell parameters, machining station programs, and inspection station acceptance parameters through the HMI. Modification of any of these parameters outside of expected bounds can impact product quality. - Engineering Workstation - Privileged control and administrative functions are granted to authorized personnel via the Engineering Workstation.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Automation Support for Control Assessments_ Project Update and Vision:

In 2017, the National Institute of Standards and Technology (NIST) published a methodology for supporting the automation of Special Publication (SP) 800-53 control assessments in the form of Interagency Report (IR) 8011. IR 8011 is a multi-volume series that starts with an overview of the methodology (volume 1) and provides guidance and specifications for automating the assessment of controls that support specific information security continuous monitoring security capabilities, one volume per capability. Four volumes have been released so far, and more volumes are in development. In 2023, the NIST Risk Management Framework project responsible for the development and maintenance of Federal Information Security Modernization Act (FISMA)-supporting technical publications and the IR 8011 series performed an internal review of the IR 8011 project. This review yielded results that offered the IR 8011 Development Team opportunities to improve the current IR 8011 methodology, facilitate its adoption, and more. This cybersecurity white paper summarizes some of the findings from this internal review. | 1. Introduction...................................................................................................................................1   |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Updates to the IR 8011 Methodology..............................................................................................2                  |
| 3. Updated Guidance and Updated Language......................................................................................6                       |
| 4. Interested Party Engagement .........................................................................................................7             |
| 5.

Automation Support for Control Assessments_ Project Update and Vision


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

Impact Levels .......................................................... 76
Impact Levels for the CI&A Categories ......................................................................................
77
3.3
3.4  Selection of Security Requirements ............................................................................................. 79
3.5  Security Requirements Example .................................................................................................. 80
3.6  Recommended Security Requirements ........................................................................................ 81
3.7  Access Control (SG.AC) ............................................................................................................. 93
3.8  Awareness and Training (SG.AT) ............................................................................................. 107
3.9  Audit and Accountability (SG.AU) ........................................................................................... 111
3.10  Security Assessment and Authorization (SG.CA) ..................................................................... 120
3.11  Configuration Management (SG.CM) ....................................................................................... 124
3.12  Continuity of Operations (SG.CP) ............................................................................................. 132
3.13  Identification and Authentication (SG.IA) ................................................................................ 139
3.14  Information and Document Management (SG.ID) .................................................................... 142
3.15  Incident Response (SG.IR) ........................................................................................................ 146
3.16  Smart Grid Information System Development and Maintenance (SG.MA) ..............................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective provide? (Part 3)

[Assistant]
Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity . It provides a current summary of ongoing activities in critical international cybersecurity standardization.
It also provides information for Federal agencies and other stakeholders to help plan more effective participation in international cybersecurity standards development and related conformity assessment activities. ## Table of Contents

| Introduction ........................................................................................................................................1   | Introduction ........................................................................................................................................1   |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1                                                                                | Why are cybersecurity standards critical? .................................................................................2                             |
| 2                                                                                | Why is conformity assessment for cybersecurity standards important?

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | 1    |
|--------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|
|                                                                                | Introduction ................................................................................................................... | Introduction ...................................................................................................................

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.3 (NIST 3.6.3)?

[Assistant]
According to Integrating Cybersecurity and Enterprise Risk Management (ERM):

3.6.3                                                                                | Continuous Improvement ... 3.6.3 Continuous Improvement

A risk-aware culture should be looking for opportunities for improvement-reinforcing effective practices and adjusting to correct deficiencies.

Integrating Cybersecurity and Enterprise Risk Management (ERM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Computer Security Log Management:

retrieved Web pages to make additional accesses to those pages more efficient. Web proxies can also be used to restrict Web access and to add a layer of protection between Web clients and Web servers.
Web proxies often keep a record of all URLs accessed through them. - GLYPH<c=31,font=/APONEK+Webdings> Vulnerability Management Software. Vulnerability management software, which includes patch management software and vulnerability assessment software, typically logs the patch installation history and vulnerability status of each host, which includes known vulnerabilities and missing software updates. 5 Vulnerability management software may also record additional information about hosts' configurations. Vulnerability management software typically runs occasionally, not continuously, and is likely to generate large batches of log entries. - GLYPH<c=31,font=/APONEK+Webdings> Authentication Servers. Authentication servers, including directory servers and single sign-on servers, typically log each authentication attempt, including its origin, username, success or failure, and date and time.

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Guide to Information Technology Security Services:

3.2.6 Review IT Security

The Contractor shall examine sensitive and critical IT systems and data files.

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Practical Combinatorial Testing:

| 1 INTRODUCTION .........................................................................................2 | 1 INTRODUCTION .........................................................................................2 | 1 INTRODUCTION .........................................................................................2 | | |-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------| | 1.1 | 1.1 | Authority..............................................................................................................2 | | | 1.2 | 1.2 | Document Scope and Purpose | .............................................................................2 | | 1.3 | 1.3 | Audience and Assumptions..................................................................................3 | | | 1.4 | 1.4 | Organization: How to use this Document...........................................................3 | | | 2 COMBINATORIAL METHODSIN TESTING.................................................4 | 2 COMBINATORIAL METHODSIN TESTING.................................................4 | 2 COMBINATORIAL METHODSIN TESTING.................................................4 | | | 2.1 | 2.1 | Two Forms of Combinatorial Testing..................................................................6 | | | 2.2 | 2.2 | The Test Oracle Problem | .....................................................................................9 | | 2.3 | 2.3 | Chapter Summary | ..............................................................................................10 | | 3 | CONFIGURATION TESTING ....................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight:

lace of management experience and prudent judgement. Aggregating the risk analysis from multiple CSRRs follows the same approach as that described in NISTIR 8286A, Section 2.3, Detailed Risk Analysis.
The method will vary by enterprise, but, for example, a three-point estimation could be used to complete the likelihood and impact columns on the combined register. Using the lowest observed value as the best case, the highest value as the worst case, and the mean value of the others as the most likely, the business unit risk manager could calculate these values. That manager could also apply their knowledge of the personnel and processes used to generate the CSRRs (e.g., a particularly detailed estimate might influence the understanding of the most likely value).

Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Access Control?

[Assistant]
According to Foundational Cybersecurity Activities for IoT Device Manufacturers:

5. What will the nature of the IoT device's data be? There is a great deal of variability in data stored by IoT devices; some devices do not store any data, while others store data that could cause significant harm if accessed or modified by unauthorized entities. Understanding the nature of expected data on a device in the context of the customers and use cases can help manufacturers identify which device cybersecurity capabilities may be needed for protecting device data, such as data encryption, device and user authentication, data validation, access control, and backup/restore. 6. What is the degree of trust in the IoT device that customers may need? Customers may expect certain device cybersecurity capabilities and implementations that allow for specific assurances about the cybersecurity of the device and/or data. For example, in some contexts, additional trust that data is protected could be achieved by adding protection of data in use within the device. This would go beyond the usual goals of data protection (e.g., protecting data at rest and in transit). 7. What complexities will be introduced by the IoT device interacting with other devices, systems, and environments? For example, complexity can be driven by new uses of IoT and IoT devices, new combinations of those devices with each other and conventional IT devices, and increasing interconnections among devices and systems. These complexities could mean new functionality, which may have human-safety or privacy implications, that will be connected via networking technologies to systems that do not appropriately mitigate these risks. An IoT device that can stream images from inside the home, such as a smart baby monitor, or that can alter the environment to the point of danger, such as a smart oven, might require safeguards not usually considered for conventional IT devices. IoT can also introduce complexities related to scale, which could make ongoing management and support of devices difficult.

Foundational Cybersecurity Activities for IoT Device Manufacturers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Small Business Information Security_ The Fundamentals:

| FOREWORD   | ....................................................................................................................................................... PURPOSE ........................................................................................................................................................... | ....................................................................................................................................................... PURPOSE ........................................................................................................................................................... | 1 1   |
|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------|
| 1          | BACKGROUND: WHAT IS INFORMATION SECURITY AND CYBERSECURITY?.............................................. | BACKGROUND: WHAT IS INFORMATION SECURITY AND CYBERSECURITY?.............................................. | 2     |
|            | 1.1                                                                                | WHY SMALL BUSINESSES?

Small Business Information Security_ The Fundamentals


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems:

- Uniform Resource Identifier (URI) to identify terminology and protocols that allow parties to read the DID document
- DID that identifies the subject of the DID document
- Set of public keys used for authentication, authorization, and communication mechanisms
- Set of authentication methods used for the DID subject to prove ownership of the DID to another entity
- Set of authorization and delegation methods for the DID subject to allow another entity to operate on their behalf (i.e., custodians)
- Set of service endpoints to describe where and how to interact with the DID subject
- Timestamp for when the document was created [optional]
- Timestamp for when the document was last updated [optional]
- Cryptographic proof of integrity (e.g., digital signature) [optional]

A blockchain  is  used  to  support  the  mapping  of  keys  to  identifiers  by  acting  as  an  integrityprotected 'bulletin board' for public key infrastructure (PKI). 1 Blockchains may be applicationspecific, such as Hyperledger Indy [24], and/or may support native smart contract platforms. In most cases, this 'bulletin board' for PKI-sometimes augmented by separate protocols atop the blockchain-forms an identifier management system (called DID method if it follows the DID specification). In addition to keys and identifiers, credentials may also rely on the blockchain.

Onchain credentials often only require onchain storage for the hashes of the credentials with the non-hash data being stored on any data store a subject has access to, be it a designated custodian or a decentralized storage system such as IPFS [40]. 6 The integrity of the data may be checked by the receiving party by hashing the credential and comparing the hash with the one found on the blockchain.  The  hashes  are  often  stored  as  state  variables  or  blockchain  logs,  the  latter  being sometimes cheaper than onchain storage (e.g., Ethereum events).

A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Security Labels for Open Systems_ an Invitational Workshop:

ple Label-Set Associations         |  14 |
| 9.1 Support by variable- and multi- set-labelling facilities      |  14 |
| 9.2 Support by single-labelling facilities                        |  14 |
| 10.
Implementation Choices and Rationale                          |  16 |
| References                                                        |  17 |

Security Labels for Open Systems_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

Security awareness programs aim to assist employees in recognizing and responding to security issues with a goal of achieving long-term behavior changes. Security awareness professionals are individuals who are tasked with managing and executing the security awareness programs within their organizations. Prior industry surveys and research studies have identified challenges security awareness professionals face. Many members of security awareness teams perform security awareness duties on a part-time basis without a job title that reflects their duties, and they may lack sufficient professional skills (e.g., communications, relationship-building) that were viewed as essential in security awareness roles. In addition, the lack of understanding that security awareness is a unique discipline may lead to ill-prepared awareness professionals. However, it is unclear if these challenges also apply to security awareness professionals in the United States (U.S.) government. other fields, including non-IT fields such as instructional design and education, communications, and human resources. We found that 40% of participants had only ever worked in a technical field (cybersecurity, IT, or software development). Cybersecurity awareness (hereafter shortened to 'security awareness') programs aim to help employees recognize and appropriately respond to security issues, with a goal of achieving longterm behavior change [WILSON]. Security awareness professionals are individuals who are tasked with managing and executing the security awareness programs within their organizations. Prior industry surveys and research studies have identified challenges security awareness professionals face. Many professionals perform security awareness duties on a part-time basis without a job title that reflects their duties, and they may lack sufficient professional skills (e.g., communications, relationship-building) that are viewed as essential in security awareness roles [SANS][WOELK].

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to 2016 NIST_ITL Cybersecurity Program Annual Report:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

2016 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N:

| 1.2 Audience.........................................................................................................
| 1                                                                                |
| 1.3                                                                                | Document Structure........................................................................................ | 1                                                                                |
| 2                                                                                | Background............................................................................................................2    | Background............................................................................................................2    |
| 2.1                                                                                | XACML ........................................................................................................... | 4                                                                                |
| 2.2                                                                                | NGAC                                                                                | .............................................................................................................

A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security of Interactive and Automated Access Management Using Secure Shell (SSH):

Stolen, leaked, derived, and unterminated identity keys pose a similar problem to stolen, leaked, derived, and unterminated interactive user account credentials. Anyone who may have obtained a copy of an identity key-by copying it from a host, by accessing a backup, by having malware harvest keys, by performing factoring to derive a key, etc.-may use that key to attempt to gain unauthorized access to a user account on one or more servers in the organization. Once access to a user account has been gained, it is generally possible to access and modify any data for that user account-including reading and modifying the memory of processes running under that user account, and modifying any executable programs owned by that user account.

Malware can be engineered to use SSH keys to spread when automated access is allowed. The mesh of interactive and automated access relationships is so dense in many cases that it is likely that an attack can spread (pivot) to most servers in an organization after penetrating the first few servers, especially if other attack vectors are used to escalate privileges. See Figure 4-1 for an illustration of pivoting.

The purpose of continuous monitoring is to ensure that the processes for provisioning, life cycle management, and termination are followed and enforced. It is also important for detecting unauthorized access that may have been illicitly provisioned by attackers as a backdoor into systems. Unauthorized and misconfigured SSH user keys should be detected. For example, anyone or anything (including malware) with access to a superuser account can technically configure new authenticators granting access to any account.

Security of Interactive and Automated Access Management Using Secure Shell (SSH)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program provide? (Part 3)

[Assistant]
ght, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-11-04 Supersedes NIST SP 800-55 Rev.
1 (July 2008) https://doi.org/10.6028/NIST.SP.800-55r1

## How to Cite this NIST Technical Series Publication

Schroeder K, Trinh H, Pillitteri VY (2024) Measurement Guide for Information Security: Volume 2 - Developing an Information Security Measurement Program. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-55v2. https://doi.org/10.6028/NIST.SP.800-55v2

## Author ORCID iDs

Katherine Schroeder: 0000-0002-4129-9243 Hung Trinh: 0000-0002-3323-0836 Victoria Yan Pillitteri: 0000-0002-7446-7506

## Contact Information

cyber-measures@list.nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/55/v2/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This document provides guidance on how an organization can develop an information security measurement program with a flexible structure for approaching activities around the development and implementation of information security measures. ## Keywords

assessment; information security; measurement; measures; metrics; performance; program; reports; security controls. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Secure Domain Name System (DNS) Deployment Guide:

The Domain Name System (DNS) is a distributed computing system that enables access to Internet resources by user-friendly domain names rather than IP addresses, by translating domain names to IP addresses and back. The DNS infrastructure is made up of computing and communication entities called Name Servers each of which contains information about a small portion of the domain name space. The domain name data provided by DNS is intended to be available to any computer located anywhere in the Internet.This document provides deployment guidelines for securing DNS within an enterprise. Because DNS data is meant to be public, preserving the confidentiality of DNS data. The primary security goals for DNS are data integrity and source authentication, which are needed to ensure the authenticity of domain name information and maintain the integrity of domain name information in transit. This document provides extensive guidance on maintaining data integrity and performing source authentication. DNS components are often subjected to denial-of-service attacks intended to disrupt access to the resources whose domain names are handled by the attacked DNS components. This document presents guidelines for configuring DNS deployments to prevent many denial-of-service attacks that exploit vulnerabilities in various DNS components. This document provides deployment guidelines for securing DNS within an enterprise. Because DNS data is meant to be public, preserving the confidentiality of DNS data pertaining to publicly accessible IT resources is not a concern. The primary security goals for DNS are data integrity and source authentication, which are needed to ensure the authenticity of domain name information and maintain the integrity of domain name information in transit. This document provides extensive guidance on maintaining data integrity and performing source authentication.

Secure Domain Name System (DNS) Deployment Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations:

Organizations shall select cryptographic devices and applications with cryptographic functions, 58 key management products 59  and key management services 60 that conform to NIST standards to the  maximum  extent  possible,  and  new  cryptographic  application  development  efforts shall comply  with  NIST  key  management  recommendations. Accordingly,  NIST  criteria  for  the security, accuracy, and utility of key management products in electronic and physical forms shall be met (e.g., see FIPS 140, SP 800-53, and Part 1). The methods used in the design, evaluation, programming, generation, production, establishment, quality assurance, and inspection procedures for key management products and services should be structured to satisfy such criteria. | The following publications are provided for reference. The provided publication dates refer to last available version of the document as of the publication of this revision of SP 800-57 Part When later revisions of these referenced documents are available, those versions should referenced instead. | The following publications are provided for reference. The provided publication dates refer to last available version of the document as of the publication of this revision of SP 800-57 Part When later revisions of these referenced documents are available, those versions should referenced instead.

Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. |
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body ....................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to A Security Perspective on the Web3 Paradigm:

blockchain; cryptocurrency; data; decentralized; decentralized identity; non-fungible tokens; smart contracts; tokens; Web3. | 1. Introduction...................................................................................................................................1   |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Background....................................................................................................................................2    |
| 3. Web3 Overview .............................................................................................................................5       |
| 3.3.1. Existing Internet Technologies .....................................................................................................8          |
| 3.3.2. Mobile Technology.......................................................................................................................8      |
| 3.3.3. Digital Identity and Verifiable Credentials ...................................................................................9               |
| 3.3.4. Decentralized Systems and Smart Contracts ...............................................................................9                     |
| 4. Web3 Security and Privacy ...........................................................................................................12            |
| 5. Conclusion ...................................................................................................................................21   |
| References.......................................................................................................................................22   |
| List of Tables                                                                                |
| Table 2.

A Security Perspective on the Web3 Paradigm


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Usability and Security Considerations for Public Safety Mobile Authentication:

first responders from EMS or Law Enforcement if they are not wearing masks or protective eyewear. Speaker recognition will be difficult due to the noisy environments in which first responders operate.
Keystroke dynamics authentication has the same critical usability issues described above for the other text entry methods (e.g., KBA, passwords, PINs). - Our analysis concludes that there are three authentication methods that are currently more promising for first responders because they do not pose critical or significant usability issues. They are embedded cryptographic tokens, on-body detection, and location-based awareness. Depending upon the implementation, these methods should not require additional user interaction to authenticate with the mobile device when it is already unlocked. For example, embedded cryptographic tokens should be configured such that it does not require a user to select between multiple digital certificates. If first responders are sharing devices, it may be necessary for multiple user profiles to be enabled on the same device, to allow the correct certificates to be used for a given responder.

Usability and Security Considerations for Public Safety Mobile Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Program Review for Information Security Management Assistance (PRISMA):

- Tests are routinely conducted to evaluate the adequacy and effectiveness of all implementations,
- Tests ensure that all policies, procedures, and controls are acting as intended and that they ensure the appropriate information security level,
- Effective corrective actions are taken to address identified weaknesses, including those identified as a result of potential or actual information security incidents or through information security alerts issued by US-CERT, vendors, and other trusted sources,
- Self-assessments, a type of test that can be performed by agency staff, by contractors, or others engaged by agency management, are routinely conducted to evaluate the adequacy and effectiveness of all implementations,
- Independent audits such as those arranged by the Government Accountability Office (GAO) or an agency Inspector General (IG), are an important check on agency performance, but are not to be viewed as a substitute for evaluations initiated by agency management,
- Information gleaned from records of potential and actual Information security incidents and from security alerts, such as those issued by software vendors are considered as test results. Such information can identify specific vulnerabilities and provide insights into the latest threats and resulting risk,
- Evaluation requirements, including requirements regarding the type and frequency of testing, are documented, approved, and effectively implemented, and
- The frequency and rigor with which individual controls are tested depend on the risks that will be posed if the controls are not operating effectively.

Program Review for Information Security Management Assistance (PRISMA)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

...... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................
5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | ..................................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Secure Domain Name System (DNS) Deployment Guide:

| 13-21 | | 13.2 Establishing Initial Trust Anchors........................................................................13-22 | | | 13.3 Maintaining Trust Anchors..................................................................................13-23 | | | 13.4 Recommendations Summary | .............................................................................13-24 | | List of Appendices | List of Appendices | | Appendix A- Definitions of Important Terms....................................................................A-1 | | | Appendix B-Vendor Specific Steps to Meet Checklist Items..........................................B-1 | | | AppendixC- Acronyms......................................................................................................C-1 | | | Appendix D-Bibliography..................................................................................................D-1 | | | List of Figures | List of Figures | | Figure 2-1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

## Analyzing Collusion Threats in the Semiconductor Supply Chain

Rekhi S, Amberiadis K, Akib AA, Srivastava A (2025) Analyzing Collusion Threats in the Semiconductor Supply Chain. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 46. https://doi.org/10.6028/NIST.CSWP.46

This work proposes a framework for analyzing threats related to the semiconductor supply chain. The framework introduces a metric that quantifies the severity of different threats subjected to a collusion of adversaries from different stages of the supply chain. Two different case studies are provided to describe the real-life application of the framework. The metrics and analysis aim to guide security efforts and optimize the trade-offs of hardware security and costs.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to A Formal Description of the SDNS Security Protocol at Layer 4 (SP4):

3.3.1                    | NA                         | NA                         | 1,5                        |
| final s/n                   | 6. 3.3.1                    | NA                         | NA                         | 1,5                        |
| connection release          | 6.

A Formal Description of the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance:

- Improved productivity:  DHS Customs and Border Patrol (CBP) used IoT to process vehicles faster at ports of entry, improving their ability to identify threats and take action.

Mr. Fagan then presented the RMF perspective positioning an IoT device as a system element in a federal information system and described the need to take a system view to fully grasp an IoT device's potential impact on system risk. He explained that introducing an IoT device or adding an Internet connection to support a device's operations may bring new mission or safety risks that in turn require additional security controls (e.g., if an IoT device is deployed in place of an operational technology [OT] device that wasn't Internet-connected). He highlighted various aspects of IoT device implementation (e.g., processing capability, power limitations, connectivity patterns) that can influence the device's impact on the system's security risks. He then walked through the steps of a risk assessment, as defined in the RMF, and some associated IoT device considerations that can apply at each step of the process.

- NIST should consider utilizing the Cybersecurity Framework (CSF) when describing risk associated with IoT devices.
- Enterprises, especially larger enterprises, are more familiar with making conscious riskbased assessments; risk evaluation may be implicit in consumer decision making, but risk language may not capture key concerns of consumers.
- For consumers, consider focusing on the privacy implications of IoT devices which could be more useful for consumers.
- A pilot effort applying the descriptors could be very useful in helping to refine them.
- The viewpoint of the party doing the risk assessment may have a significant influence on their view of the risk of a product (e.g., assessment in a laboratory vs. an operational context)

Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

3 The SCAP Validation Program does not provide physical certificates to the participating vendors.

SCAP.V.100.1:  The vendor SHALL indicate where in the product documentation information regarding the use of SCAP and its components can be found. This MAY be a physical document or an electronic document (e.g., a PDF, help file, etc.).

Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Random Bit Generator (RBG) Constructions:

Cryptography  and  security  applications  make  extensive  use  of  random  bits. However,  the generation of  random  bits  is  challenging  in  many  practical  applications  of  cryptography. The National Institute of Standards and Technology (NIST) developed the Special Publication (SP) 80090 series to support the generation of high-quality random bits for both cryptographic and noncryptographic purposes. The SP 800-90 series consists of three parts:

| [AIS20]       | BSI (2025) Anwendungshinweise und Interpretationen zum Schema (AIS) (AIS 20, Version 4) (Bundesamt für Sicherheit in der Informationstechnik [BSI], Bonn, Germany). Available at https://www.bsi.bund.de/dok/ais-20-                                                                                |
|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [AIS31]       | BSI (2025) Funktionalitätsklassen und Evaluationsmethodologie für physikalische Zufallszahlengeneratoren (AIS 31, Version 4) (Bundesamt für Sicherheit in der Informationstechnik [BSI], Bonn, Germany). Available at                                                                                |
| [BSIFunc]     | https://www.bsi.bund.de/dok/ais-20-31 Peter M, Schindler W(2024) A Proposal for Functionality Classes for Random Number Generators (Version 3.0). (Bundesamt für Sicherheit in der Informationstechnik [BSI], Bonn, Germany). Available at https://www.bsi.bund.de/dok/ais-20-31-appx-2024                   |
| [FIPS_140]    | National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules. (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 140-3.

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Proceedings of the Workshop of the Federal Criteria for Information Technology Security:

Integrity 18

Integrity 19

- The unbundling of functional requirements from each other and from assurances.
- The creation of protection profiles by assembling pre-defined components and elaborating them to specific product targets.
- The explicit sq)aration of documentation, process, and evaluation assurance.
- Recognition ofEase of Use, Physical Protection, and Flaw Remediation (this > thought to be especially important to retain) as requirements.

Proceedings of the Workshop of the Federal Criteria for Information Technology Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Managing the Security of Information Exchanges:

The less expensive alternative is to connect systems over a public network (e.g., the internet) using a VPN. A VPN is a network that enables two or more parties to communicate securely across a public network by creating a private connection, or 'tunnel,' between endpoints. Information transmitted via VPN over a public network can be intercepted by unauthorized parties. However, the use of authentication and encryption helps ensure the confidentiality and integrity of the information

- Network Interconnection - A physical or virtual communications link between two or more networks operated by different organizations or operated within the same organization but within different authorization boundaries. - Application Interconnection - A logical communications link between two or more applications operated by different organizations or within the same organization but within different authorization boundaries used to exchange information or provide information services (e.g., authentication, logging). Application interconnections include file-sharing services or applications and information exchange feeds that occur at the session, presentation, or application layer. - future growth is anticipated. If new hardware is required, select products that are interoperable with existing hardware. - Specific Software Requirements : Identify software needed to support the information exchange, including software for information exchange management and file sharing services, and on what hardware the software is to be installed (e.g., firewalls, servers, workstations, and laptops). Determine whether existing software is sufficient or whether additional software is required. If new software is required, select products that are interoperable with existing software. - User Community : Define the community of users requiring access to the exchanged information.

Managing the Security of Information Exchanges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0 provide? (Part 5)

[Assistant]
INTRODUCTION.............................................................................................................................. | 1. INTRODUCTION.............................................................................................................................. | 1                                                                                |
| 1.1                                                                                | I DENTIFICATION...........................................................................................................................1                                                                                |                                                                                |
| 1.2                                                                                | OVERVIEW....................................................................................................................................1                                                                                |                                                                                |
| 2. TOE DESCRIPTION......................................................................................................................... | 2. TOE DESCRIPTION.........................................................................................................................

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions:

3.1.3                                                                                | Converting State Arrays to Strings... 3.1.3 Converting State Arrays to Strings

Let A denote  a  state  array. 3.1.3.

SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations provide?

[Assistant]
## Summary of NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations

Kelley Dempsey Computer Security Division Information Technology Laboratory

Greg Witte Doug Rike G2, Inc. Annapolis Junction, MD

February 19, 2014

<!-- image -->

## Abstract

This white paper provides an overview of NIST Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations , which was published April 30, 2013. ## Keywords

assurance; computer security; FIPS Publication 199; FIPS Publication 200, FISMA; Privacy Act; Risk Management Framework; security controls; security requirements

## Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST, nor does it imply that the products mentioned are necessarily the best available for the purpose. ## Additional Information

For additional information on NIST's Computer Security Division programs, projects and publications, visit the Computer Security Resource Center, csrc.nist.gov. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is available at www.nist.gov and www.nist.gov/itl.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-218A

## Secure Software Development Practices for Generative AI and Dual-Use Foundation Models

An SSDF Community Profile

Harold Booth Murugiah Souppaya Apostol Vassilev Michael Ogata Martin Stanley

Karen Scarfone

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-218A

<!-- image -->

## NIST Special Publication 800 NIST SP 800-218A

## Secure Software Development Practices for Generative AI and Dual-Use Foundation Models

An SSDF Community Profile

Harold Booth Murugiah Souppaya Apostol Vassilev

Computer Security Division Information Technology Laboratory

Michael Ogata

Applied Cybersecurity Division Information Technology Laboratory

Martin Stanley Cybersecurity and Infrastructure Security Agency (CISA)

Karen Scarfone Scarfone Cybersecurity

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-218A

July 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does System and Network Security Acronyms and Abbreviations provide?

[Assistant]
<!-- image -->

NIST Interagency Report 7581 September 2009

## System and Network Security Acronyms and Abbreviations

Karen Scarfone Victoria Thompson

NIST Interagency Report 7581 September 2009

System and Network Security Acronyms and Abbreviations

Karen Scarfone Victoria Thompson

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

September 2009

<!-- image -->

U.S. Department of Commerce

Gary Locke, Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Deputy Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Interagency Report discusses ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Interagency Report 7581 32 pages (Sep. 2009)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.

System and Network Security Acronyms and Abbreviations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Guidelines for Media Sanitization:

3.1.1. 3.1.1), purge (see Sec. 3.1.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Trustworthy Email:

�e  Information Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the costeffective security and privacy of other than national s ecurity-related information in federal information systems. �e Special Publication 800 -series reports on ITL's research, guidelines, and outreach  efforts  in  informat ion  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

In addition to MUAs and MTAs , there are other network components used to suppo rt the email service for an organization. Most obviously is the physical infrastructure: the cables, wireless access points, routers and switches that make up the network . In addition, there are network components used by email components in the process of completing their tasks . �is includes the DNS , Public Key Infrastructure (PKI), and network security components that are used by the organization.

for physical harm or for committing financial fraud) is called phishing. From the above discussion of email bombing attacks, it should be clear that spam can sometimes be a type of email bombing.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to Security for Full Virtualization Technologies:

1-1 | | | 1.1 | Authority.................................................................................................................1-1 | | | | 1.2 | Purpose and Scope................................................................................................1-1 | | | | 1.3 | Audience ................................................................................................................1-1 | | | | 1.4 | Document Structure ...............................................................................................1-1 | | | 2.

Guide to Security for Full Virtualization Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

................................................................... | Executive Summary.................................................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| U.S. Government Vulnerability Disclosure..................................................................... | 2                                                                                |                                                                                |
| Usage of Document Terminology................................................................................ | 5                                                                                |                                                                                |
| Federal Vulnerability Disclosure Coordination Body .................................................... | 6                                                                                |                                                                                |
| Preparation.................................................................................................................

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to ISCMA_ An Information Security Continuous Monitoring Program Assessment:

| The Principal Assessment Workbook....................................................................

ISCMA_ An Information Security Continuous Monitoring Program Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Computer Security Training & Awareness Course Compendium:

| CONTROL AND SECURITY OF LANS | 50 | |-------------------------------------------------------------------------------------|-----------------------------------------------------------------------| | DATA CENTER RECOVERY PLANNING (M2040) | 20 | | DATA COMMUNICATIONS SECURITY | 28 | | DATA SECURITY PLANNING: STRATEGIES FOR EFFECTIVE INFORMATION SECURITY (W9898) | 22 | | DATA SECURITY PLANNING | 68 | | DATABASE SECURITY SEMINAR | 65 | | DETECTING AND PREVENTING COMPUTER FRAUD | 11 | | DEVELOPING COMPUTER SECURITY POLICIES & PROCEDURES | 28 | | DISASTER RECOVERY PLANNING | 70 | | DISASTER RECOVERY PLANNING: STRATEGIES TO DEVELOP & MAINTAIN PROVABLE | DISASTER RECOVERY PLANNING: STRATEGIES TO DEVELOP & MAINTAIN PROVABLE | | RECOVERY CAPABILITY (W9912) | 20 | | EDI: New Frontiers For Auditors | 56 | | EDP AUDITING - CIS 433 | 78 | | EDP CONCEPTS FOR BUSINESS | 6 | | EDP AUDITING: THE FIRST STEP | 52 | | EXECUTIVE AIS SECURITY BRIEFING | 8 | | FEDERAL AIS COMPUTER SECURITY REQUIREMENTS | 4 | | FUNDAMENTALS OF COMPUTER SECURITY FOR FEDERAL INFORMATION SYSTEMS | 64 | | HOW TO MANAGE AN INFORMATION SECURITY PROGRAM: A GUIDE FOR NEWLY APPOINTED MANAGERS | 23 | | IMPLEMENTING & MANAGING A COMPUTER SECURITY PROGRAM | 19 | |

Computer Security Training & Awareness Course Compendium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Guide to Information Technology Security Services:

3.3.1 Review Risk Assessment and Security Plan

The Contractor shall review the appropriate <organization name> risk assessment and <organization name> security plan for the sensitive systems addressed by this SOW.

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Security Requirements for Cryptographic Modules:

This standard shall be used in designing and implementing cryptographic modules that federal departments and agencies operate or are operated for them under contract. The standard provides four  increasing,  qualitative  levels  of  security  intended  to  cover  a  wide  range  of  potential applications and environments. The security requirements cover areas related to the secure design, implementation  and  operation  of  a  cryptographic  module. These  areas  include  cryptographic module  specification;  cryptographic  module  interfaces;  roles,  services,  and  authentication; software/firmware  security;  operating  environment;  physical  security;  non-invasive  security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks. 1. Name of Standard. Security Requirements for Cryptographic Modules (FIPS PUB 140-3). 2. Category of Standard. Computer Security Standard, Cryptography. 3. Explanation. This  standard  specifies  the  security  requirements  that  will  be  satisfied  by  a cryptographic  module  utilized  within  a  security  system  protecting  sensitive  but  unclassified information (hereafter referred to as sensitive information). The standard provides four increasing, qualitative levels of security: Level 1, Level 2, Level 3, and Level 4. These levels are intended to cover the wide range of potential applications and environments in which cryptographic modules may  be  employed. The  security  requirements  cover  areas  related  to  the  secure  design  and implementation  of  a cryptographic module. These  areas  include  cryptographic  module specification; cryptographic module interfaces; roles, services, and authentication; software/firmware  security;  operating  environment;  physical  security;  non-invasive  security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks.

Security Requirements for Cryptographic Modules


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4) provide? (Part 5)

[Assistant]
for Open System Interconnection (OSI) [4]. SP4 consists of a simple encapsulation/decapsulation protocol that protects normal Transport Protocol data units within a cryptographically secure envelope.
SP4 is compliant with the security addendum to the OSI BRM [5], and forms the basis of the emerging ISO standard for a Transport Layer Security Protocol [6]. SP4 extends the OSI Transport connectionless and connection oriented standards [7,8] to provide or support the following security services defined in the security addendum:

- (1) Data Integrity,
- (2) Data Confidentiality,
- (3) Data Origination Authentication, and
- (4) Access Control. ## 1.2 Objectives

This report specifies the Protocol Implementation Conformance Statement (PICS) proforma for SP4. The supplier of a protocol implementation which is claimed to conform to the SDNS Standard [1] shall complete the SP4 PICS proforma. A completed PICS proforma becomes the PICS for the implementation in question. The PICS is a statement identifying the capabilities and options of the protocol that have been implemented. The PICS can serve a number of purposes, including as:

- (1) a check list for the protocol implementer, to reduce the risk of failure to conform to the standard through oversight;

- (2) a detailed indication for the supplier and receiver of the implementation of its capabilities, stated relative to the common basis of understanding provided by the standard PICS proforma;
- (3) a basis for the user of the implementation to check the possibility of interworking with another implementation;
- (4) the basis for a protocol tester to select appropriate tests against which to assess the claim for conformance of the implementation. The remainder of this report defines the procedures, format, and content that comprise the SP4 PICS proforma. The format is intended to follow the style used in the PICS proforma for the transport protocol [9]. Most of the content is derived directly from the SP4 standard [1].

Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4)

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to BIOS Protection Guidelines for Servers:

server motherboard. The Service Processor microcontroller runs a specialized operating system typically stored in flash memory, and provides administrators with an interface to manage the host server.
The Service Processor is typically a highly privileged component in modern servers, often capable of updating firmware and software on the system, changing configuration settings, and reading from system memory. This document assumes administrators will implement proper computer, network, and physical security controls to mitigate the unique risks to Service Processors. For instance, typically administrators interact with the Service Processor over a network interface. Security best practices dictate that the Service Processor should be on a private LAN accessible only to system administrators.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Managing the Security of Information Exchanges:

| ...........................................................................................................
3                        |
| 2.1 Information Exchange ....................................................................................................4       |                                                                                |
| 2.1.1 System Interconnections ....................................................................................5                  |                                                                                |
| 2.1.2 Methods of Information Exchange                                                                                | .....................................................................7                                                               |
| 2.2 Information Exchange: Accessing or Transferring the Information................................8                                 |                                                                                |
| 3 Information Exchange Security Management................................................................... | 9                                                                                |
| 3.1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

- DevSecOps pipelines are involved in building, checking in, and checking out from a container registry called Iron Bank, a repository of DOD-vetted hardened container images.
- The Air Force's Platform One, the DevSecOps platform that enabled the concept of continuous authority to operate (C-ATO), which in turn streamlined the DOD's authorization process to accommodate the speed and frequency of modern continuous software deployments.
- The National Geospatial-Intelligence Agency (NGA) outlined its DevSecOps strategy in 'The NGA Software Way,' where three key metrics - availability, lead time, and deployment frequency - are laid out for each of its software products, along with specification of seven distinct product lines for enabling DevSecOps pipelines, including messaging and workflow tools.
- The Centers for Medicare and Medicaid Services (CMS) is adopting a DevSecOps approach where one emphasis is on laying the groundwork for the software bill of materials (SBOM) - a formal record that contains the details and supply chain relationships of various components used in building software. The purpose of producing SBOMs is to meet the goals established under the Continuous Diagnostics and Mitigation (CDM) program.

| Policy Category                   | Example Policies                                                                    |
|-----------------------------------|-------------------------------------------------------------------------------------|
|                                   | • Ensure that policies of all types do not have conflicts                           |
| Supply chain policies             | • Allow only approved container registries • Allow only certified libraries         |
| Audit and accountability policies | • Ensure that there are policies associated with audit and accountability functions |

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

This section presents background information about IoT devices that organizations should consider in their device acquisition processes. This publication draws from other NIST guidance, namely the Risk Management Framework (RMF) [800-37], the Cybersecurity Framework (CSF) [CSF], and NIST SP 800-161, Cyber Supply Chain Risk Management Practices for Systems and Organizations [800-161]. Organizations familiar with this guidance and the context of IoT devices within a system could skip this section. It is expected that organizations will follow the RMF steps to manage risk to the system and organization throughout the system development life cycle. As IoT devices are introduced to the system, often after it is in operation, it is critical to consider the security impact of such changes. Since IoT devices will often be integrated into existing systems, this publication will provide guidance for organizations in the context of the RMF. Considering an IoT device as an enabling or other system does not alleviate all cybersecurity considerations on the part of an organization. The IoT device will still exist in another authorization boundary, which may or may not be managed by organizations that do not necessarily use the RMF (e.g., the manufacturer of the device, third-party service provider). That organization (i.e., that manages the IoT device within their authorization boundary) would have to be responsible for many aspects of risk management related to the IoT device, but any organization that uses the IoT device directly, services it provides, and/or its data will have responsibilities related to cybersecurity of that IoT device and its data. Readers of this document should refer to NIST SP 800-161 Revision 1, Cyber Supply Chain Risk Management Practices for Systems and Organizations [800-161] to understand these responsibilities and supporting practices.

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Review of U.S. and European Security Evaluation Criteria provide? (Part 2)

[Assistant]
RUSTED INTERPRETATION                                                                                | NETWORK        |    |    |
| 4 . 0      | TRUSTED MANAGEMENT SYSTEM INTERPRETATION ...
| DATABASE       |    |    |
| 5.0        | IT SECURITY CRITERIA - CRITERIA FOR THE EVALUATION OF THE TRUSTWORTHINESS OF INFORMATION TECHNOLOGY (IT) SYSTEMS |                |    |    |
| 6 . 0      | DRAFT TECHNOLOGY SECURITY EVALUATION CRITERIA                                                                    | INFORMATION    |    |    |
| 7.0        | ANALYSIS OF SECURITY CRITERIA SETS ... | AND COMPARISON |    |    |
| 7.1        | U.S. EVALUATION CRITERIA - ORANGE BOOK, RED BOOK,                                                                | SECURITY TDI   |    |    |
| 7.2        | U.S. SECURITY EVALUATION CRITERIA                                                                                | vs. EUROPEAN   |    |    |
| 8.0        | TRUSTED TECHNOLOGY                                                                                | SYSTEM         |    |    |
| 9.0        | FUTURE IN THE DEVELOPMENT OF SECURITY                                                                            | U.S.

A Review of U.S. and European Security Evaluation Criteria

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity